dn: olcDatabase={2}hdb,cn=config
changetype: modify
replace: olcSuffix
olcSuffix: dc={{ datacenter }},dc={{ domain }}
-
replace: olcRootDN
olcRootDN: cn={{ slapd_root_user }},dc={{ datacenter }},dc={{ domain }}
-
replace: olcRootPW
olcRootPW: {{ slapd_root_pass_hash }}
-
add: olcDbIndex
olcDbIndex: entryUUID eq
-
add: olcDbIndex
olcDbIndex: entryCSN eq
-
add: olcAccess
olcAccess: {0}to attrs=userPassword,shadowLastChange by self write
  by anonymous auth
  by * none
-
add: olcAccess
olcAccess: {1}to dn.base="" by * read
-
add: olcAccess
olcAccess: {2}to * by * read
{% if slapd_servers | length > 1 %}
-
add: olcSyncRepl
{% for host in slapd_servers %}
olcSyncRepl: rid=00{{ loop.index + slapd_servers | length }}
  provider={% if slapd_ssl | bool %}ldaps{% else %}ldap{% endif %}://{{ host }}
  binddn="cn={{ slapd_root_user }},dc={{ datacenter }},dc={{ domain }}"
  bindmethod=simple
{% if slapd_ssl | bool %}
  starttls=yes
  tls_cert="{{ slapd_cert_path }}/server.crt"
  tls_key="{{ slapd_cert_path }}/server.key"
  tls_cacert="{{ slapd_cert_path }}/ca-cert.pem"
  tls_reqcert=demand
{% endif %}
  schemachecking=on
  credentials={{ slapd_root_pass }}
  searchbase="dc={{ datacenter }},dc={{ domain }}"
  type=refreshOnly
  interval=00:00:00:10
  retry="5 5 300 5"
  timeout=10
{% endfor %}
-
add: olcMirrorMode
olcMirrorMode: TRUE
{% endif %}
